CVE-2022-23606: Crash when a cluster is deleted in Envoy
A flaw was found in envoy. When a cluster is deleted via the Cluster Discovery Service, a stack exhaustion may occur.
Other sources
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.
Stack exhaustion when a cluster is deleted via Cluster Discovery Service.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-23606?
CVE-2022-23606 is a vulnerability found in Envoy, an open-source edge and service proxy, which allows for a stack exhaustion leading to denial of service (DoS) when a cluster is deleted via the Cluster Discovery Service (CDS).
What is the severity of CVE-2022-23606?
The severity of CVE-2022-23606 is rated as medium with a CVSS (Common Vulnerability Scoring System) score of 6.5.
How does CVE-2022-23606 impact Envoy?
CVE-2022-23606 impacts Envoy by causing a stack exhaustion, resulting in a denial of service (DoS) condition when a cluster is deleted via the Cluster Discovery Service (CDS).
Which versions of Envoy are affected by CVE-2022-23606?
Versions up to and including 1.20.2 and version 1.21.0 of Envoy are affected by CVE-2022-23606.
How can I mitigate CVE-2022-23606?
To mitigate CVE-2022-23606, it is recommended to upgrade to Envoy version 1.20.3 or later, or version 1.21.1 or later.